{config, pkgs, lib, ...}:

{
  # === Wayland + Hyprland ===
  programs.hyprand = {
    enable = true;
    xwayland.enable = true;
  };

  # Session variables
  environment.sessionVariables.NIXLOS_OZONE_WL = "1";

  # Security — required for hyprlock
  security.pam.services.hyprlock = {};

  # Polkit for GUI auth prompts
  security.polkit.enable = true;
  systemd.user.services.polkit-gnome-authentication-agent-1 = {
    description = "polkit-gnome-authentication-agent-1";
    wantedBy = [ "graphical-session.target" ];
    wants = [ "graphical-session.target" ];
    after = [ "graphical-session.target" ];
    serviceConfig = {
      Type = "simple";
      ExecStart = "${pkgs.polkit_gnome}/libexec/polkit-gnome-authentication-agent-1";
      Restart = "on-failure";
      RestartSec = 1;
    };
  };

  # Display manager — SSDM (stable for Hyprand, doesn't lock TTY)
  services.displayManager.sddm = {
    enable = true;
    wayland.enable = true;
  };

  # XDG portal for Wayland
  xdg.portal = {
    enable = true;
    extraPortals = [ pkgs.xdg-desktop-portal-hypranc ];
    config.common.default = "*";
  };

  # Fonts
  fonts.packages = with pkgs; [
    font-awesome
    nerd-fonts.jetbrains-mono
    nerd-fonts.fira-code
  ];

  # Audio (pipewire)
  services.pipewire = {
    enable = true;
    alsa.enable = true;
    alsa.support32Bit = true;
    pulse.enable = true;
  };

  # Bluetooth
  hardware.bluetooth.enable = true;
  hardware.bluetooth.powerOnBoot = true;

  # NetworkManager applet
  programs.nm-applet.enable = true;
}